The US and allies reveal that hacker group Cadet Blizzard is part of Russia's GRU Unit 29155, which is responsible for coup attempts, assassinations, and more
Unit 29155 of Russia's GRU military intelligence agency—a team responsible for coup attempts, assassinations, and bombings …
Context & Ripple Effects
Cadet Blizzard had already been publicly associated with Russia's GRU after Microsoft linked it to WhisperGate data-wiping attacks in Ukraine shortly before the 2022 invasion. The allied disclosure narrows that attribution from a broad service affiliation to a specific GRU unit.
That unit-level identification connects Cadet Blizzard's cyber activity to an organization described in the coverage as conducting physical and political operations, while later reporting traces Unit 29155's hacking and disinformation work as part of a broader campaign capability.
First-order effects
- US and allied defenders can treat Cadet Blizzard activity as tied to GRU Unit 29155, improving the operational context for incident response, intelligence sharing, and public attribution.
- The disclosure raises the reputational and diplomatic cost for Russia by connecting a named cyber group to a unit alleged to have conducted coup attempts, assassinations, and bombings.
Second-order effects
- Organizations tracking Cadet Blizzard will need to assess incidents not only as espionage or disruption risks but as activity linked to a unit with wider state-directed objectives.
- The finding strengthens the case for partners to pool technical indicators and attribution evidence; it also makes Russian efforts to obscure operator identity more consequential, as later coverage describes use of other groups' tools to complicate attribution by another Russia-backed actor.
Third-order effects
- If allied governments continue to identify cyber groups at the unit level, cyber threat reporting will increasingly map digital campaigns onto military and intelligence command structures rather than standalone hacker labels.
- That shift could make coordinated deterrence and sanctions more targeted, but its practical value depends on whether public attribution is matched by sustained defensive cooperation and consequences.
The trend: State cyber attribution is moving from naming malware groups toward tying operations to the military and intelligence units that direct them.
Related: Cadet Blizzard · GRU Unit · Dual-use code intelligence · Microsoft research on Cadet Blizzard and WhisperGate · Inside GRU Unit 29155's hacking department
Related Coverage
- Russian Military Cyber Actors Target US and Global Critical Infrastructure Cybersecurity …
- Estonia says Russian military intelligence behind cyber-attacks Euractiv · Aurélie Pugnet
- Five Russian GRU Officers and One Civilian Charged for Conspiring to Hack Ukrainian Government US Department of Justice
- Western Governments Uncover New GRU Hacking Group Cadet Blizzard Metacurity · Cynthia B Brumfield
- US charges Russian military officers for unleashing wiper malware on Ukraine Ars Technica · Dan Goodin
- Russian military hackers linked to critical infrastructure attacks BleepingComputer · Sergiu Gatlan
- Russian hackers with military links charged after critical infrastructure attacks TechRadar
- US charges five Russian military hackers with targeting Ukraine's government with destructive malware TechCrunch · Lorenzo Franceschi-Bicchierai
- US and Allies Accuse Russian Military of Destructive Cyber-Attacks Infosecurity · James Coker
- Russian Cyber Unit 29155 Exposed: Targeting NATO and Allied Nations The Cyber Express · Samiksha Jain
- New NSA Report Pins Russian Military Hackers For U.S. Attacks Since 2020 Forbes · Davey Winder
- Russian cyber militants responsible for damage to critical assets: US offers $10 million bounty Cybernews.com · Ernestas Naprys
- Russia-linked GRU Unit 29155 targeted critical infrastructure globally Security Affairs · Pierluigi Paganini
- U.S., allies accuse Russia of wide-ranging cyberattacks targeting Ukraine, NATO UPI · Darryl Coote
- The ASD's ACSC and other security agencies warn of active Russian military hackers Cyber Daily · David Hollingworth
- NSA, FBI, CISA, and Allies Issue Advisory about Russian Military Cyber Actors National Security … · National Security Agency
- Cadet Blizzard hacking group linked to unit of Russia's GRU SiliconANGLE · Maria Deutscher
- US charges 5 Russian spies for Ukraine, NATO cyberattacks CSO · Lucian Constantin
- Indictment of Russian national expanded to five more for cyber operations in Ukraine, Western allies Baltimore Sun · Kiersten Hacker
- US Broadens Indictments Against Russian Intelligence Hackers PaymentSecurity.io · Chris Riotta
- 5 Russian military hackers plotted to spread malware to Ukraine through a US company, new charges say Nextgov/FCW · David DiMolfetta
- “Not Advanced Cyber Masterminds”: DOJ Indicts Five Russian GRU Officers and a Civilian for Hacks Into Ukrainian Critical Infrastructure and US Federal Systems The Gateway Pundit · Brian Lupo
- US warns Russian hackers: ‘We are onto you’ Voice of America · Jeff Seldin
- US, allied nations accuse Russia of cyberattacks against Ukraine and NATO Politico · Maggie Miller
- US charges 6 Russians for cyberattacks on NATO countries that support Ukraine, including US Scripps News · Alex Arger
- U.S. Indicts Members of Russian Military Intelligence Over Cyberattack on Ukraine New York Times
- Russian GRU Unit Tied To Assassinations Linked To Global Cyber Sabotage And Espionage SecurityWeek · Ryan Naraine
- On the unlikely off-chance that the US actually gets their hands on any of these Russian hackers, Putin would just grab a few Americans living in Russia and trump up charges against them. — There has been a lot of talk this week about Putin paying “useful idiots” to spread his propaganda. … @CarlG@esq.social · Carl Graham
- Intelligence agencies have revealed that unit 29155 of Russia's GRU—a unit responsible for coup attempts, assassinations, and bombings—has is now engaged in brazen hacking operations with targets across the world, including in Ukraine and the US. https://www.wired.com/... @agreenberg@infosec.exchange · Andy Greenberg
- This is an important read for anyone working in Critical Infrastructure. Russia's GRU Unit 29155 has been named as targeting global CI by US allies. … Brent Muir
- And once again, the infamous GRU unit of the russian federation, already tainted by serious crimes, is being accused of cybercrimes by the U.S. … Serhii Demediuk
- Intelligence agencies and the FBI, DOJ and CISA have revealed that unit 29155 of Russia's GRU—a unit responsible for coup attempts, assassinations … Andy Greenberg
- US charges Russian military officers for unleashing wiper malware on Ukraine Ars OpenForum
Discussion
-
@dojnatsec
@dojnatsec
on x
Five Russian GRU Officers and One Civilian Charged for Conspiring to Hack Ukrainian Government 🔗: https://www.justice.gov/... [image]
-
@mfaestonia
@mfaestonia
on x
Today, #Estonia for the first time attributed #cyberattacks against Estonian state to the perpetrator. An international investigation has shown that 🇪🇪 among other @NATO & #EU members & #Ukraine was hit by attacks carried out by Russia's military intelligence GRU unit 29155. 1/3 …
-
@fbi
@fbi
on x
Today, DOJ unsealed an indictment charging Russian GRU military intelligence officers—part of a group known as Unit 29155—with conducting offensive hacking operations before and after the invasion of Ukraine. Read about the indictment and Unit 29155 here: https://www.justice.gov/…
-
@a_greenberg
Andy Greenberg
on x
Intelligence agencies and FBI/DOJ have revealed that unit 29155 of Russia's GRU—a unit responsible for coup attempts, assassinations, and bombings—is now engaged in brazen hacking operations with targets across the world, including in Ukraine and the US. https://www.wired.com/...
-
@danwblack
Dan Black
on x
An astute observation in Andy's piece that is often lost in the mirroring-imaging fueled rush to judgment common in analyses of Russia's cyber campaigns. “Success is measured differently in the Western world and Russia”
-
@nsa_csdirector
Dave Luber
on x
Organizations should take immediate action to secure data and mitigate harms from Russian military cyber intrusions. NSA is committed to continue providing cyber threat intelligence and mitigation recommendations. Read the latest joint guidance now and protect your networks.
-
@a_greenberg
Andy Greenberg
on x
Parents, are you monitoring what your teens are up to online? If not, they may well be carrying out cyberattacks against the Ukrainian government as part of a notorious sabotage and assassination unit of Russian military intelligence. [image]
-
@colbybadhwar
Colby Badhwar
on x
🇺🇲🇷🇺 FBI issuing arrest warrants for Russian Military Intelligence officers for cyber attacks against Ukraine and other western countries. [image]
-
@fbi
@fbi
on x
The #FBI, @CISAgov, @NSAgov and other partners released a #CybersecurityAdvisory identifying the tactics, techniques and procedures of a group of Russian GRU military intelligence cyber actors responsible for destructive cyber operations against Ukraine: https://www.ic3.gov/... […
-
@ncsc
@ncsc
on x
🚨Today, the NCSC and partners have issued a joint advisory unveiling Russian military intelligence hackers for a campaign of malicious cyber activity targeting government bodies and critical infrastructure around the world https://www.ncsc.gov.uk/...
-
@danwblack
Dan Black
on x
WhisperGate attack (rel Cadet Blizzard, UNC2589) linked to Unit 29155: “Five of the defendants were officers in Unit 29155 of the Russian Main Intelligence Directorate (GRU), a military intelligence agency of the General Staff of the Armed Forces.” https://www.justice.gov/...
-
@20committee
John Schindler
on x
Also attacks on US spies and diplomats in many countries with their mysterious acoustic weapon, crippling and even killing Americans...but according to Biden's DNI that's just imaginary!
-
@itsdeanblundell
Dean Blundell
on x
It gets better. US just released a superseding indictment charging 5 Russians/Putin with everything from hacking to attempted coups to assassination attempts. Convoys too. Everything. Is. Happening.
-
@ericgeller
Eric Geller
on x
DOJ has unsealed an indictment charging 6 Russian government hackers with the “WhisperGate” wiper-malware hacking campaign against Ukrainian critical infrastructure and, later, U.S. and allied networks. https://www.justice.gov/... CISA's got an advisory: https://www.cisa.gov/... …
-
@danwblack
Dan Black
on x
14 services in 10 countries. 🔥🔥🔥 Operation Toy Soldier is a remarkable feat of collective counterintelligence action, exposing an aggressive cyber campaign against Ukraine and NATO, now linked to one of the GRU's most brazen elements. #StrongerTogether
-
@nsacyber
@nsacyber
on x
Russian military cyber actors continue to target U.S. and global critical infrastructure. Network defenders must regularly update mitigation measures to stay ahead of these attacks. Make sure you're up to date by reading our newest guidance: https://www.nsa.gov/... [image]
-
@johnhultquist
John Hultquist
on x
This announcement underscores the seriousness of some of these intrusions as well as the thin line between physical and cyber threat.
-
@realstevefriend
Steve Friend
on x
The @FBI wasted American tax dollars indicting 6 Russians living in Russia for computer crimes against Ukraine. No one will be arrested. This is just another desperate attempt to get a headline and push a fake “Russia hacked the election” narrative. Defund the FBI.